KR20100127807A - Secure browser-based applications - Google Patents

Abstract

Techniques for executing limited tasks by computer program code that are authorized to invoke limited tasks are provided when an implicit or explicit consent is received from a web browser. The technique includes generating a risk class for a computer program code component that includes at least one component task for executing at least one limited system task; And presenting a prompt to a user for permission to execute the at least one limited system task, wherein the prompt includes a description of the hazard class and the component task. The program code may include script code associated with a web page that invokes a web browser plug-in, which then triggers the restricted system task. The code may invoke the restricted system task in response to receiving input from a user via the web browser, the input causing an action associated with performing the task, the action indicating consent to perform the task. Implicitly granted.

Description

Secure Browser Based Application {SECURE BROWSER-BASED APPLICATIONS}

<Citation of Related Applications>

This application is published in U.S. Application No. 61 / 067,872 filed March 2, 2008 titled: "Browser-Based Applications and Interfaces Having Secure Access to Secure Access to Native Operating System Features." to Native Operating Features) "], which is hereby incorporated by reference in its entirety.

The present invention generally relates to executing user-provided computer program code in a restricted execution environment, and in particular to enabling the dissemination and execution of user-supplied computer program components in a security-restricted execution environment such as a web browser.

Techniques for executing computer code in a web browser are well known. The web page may contain code written in a language such as JavaScript ™ that will be executed if the page is displayed to the user in a browser such as the Microsoft® Internet Explorer ™ browser, Mozilla® Firefox® browser, and the like. Code written in programming languages such as the Java® language, the Microsoft®Jscript® language, and the Microsoft®C # ® language can be downloaded from an Internet server (eg, a website) executed by a web browser. Any type of code or data, such as an Adobe® Flash®script or Portable Document Format (PDF) document, is not supported by the browser itself, that is, can be executed, but the browser can be extended with plug-ins that support such special file types. have. Plug-ins are computer program code modules, for example, invoked by a browser (or other application) that use features of the browser to display information, receive input, transmit data over the network, and so on. You can do it. The plug-in provides special features and usually operates in response to receipt of some type of web content associated with the plug-in, eg, loaded from disk and initialized by a browser. Plug-ins are written in a programming language such as C or C ++, for which the browser provides a plug-in Application Programming Interface (API). Unlike script code, such as JavaScript, that browsers run in a secure environment that prevents code downloaded from the Internet from accessing files or performing confidential system tasks such as opening a network connection to a remote computer, The code to implement is usually native code that can be executed by a computer processor. Such native code can perform confidential system tasks without the same level of security restrictions as browser executable script code, which could allow unauthorized access to data or compromise system security. Therefore, use of plug-ins from unknown or untrusted sources will be reluctant, and users will not use plug-ins provided by vendors that they do not know well. Moreover, creating browser plug-ins is relatively difficult and expensive for several reasons. For example, you need to find and solve security problems. In addition, many browsers in plug-in development use platform-specific programming languages that are relatively difficult to use, and for each type of platform that the platform will support (for example, Microsoft Windows® operating system, Apple® Mac OS operating system, Linux® operating system, etc.) Create and deploy a platform-specific version of the plug-in, and for each browser type supported by each platform, such as Internet Explorer on Windows, FireFox on Windows, FireFox on Mac OS, and Safari® browser on Mac OS. You may need to create and distribute a.

As mentioned above, security restrictions are imposed on code executed by a web browser, especially if the code is from an unknown or untrusted server, because of the harm that program code accessing a computer resource can cause. Most web browsers, for example, place restrictions on downloaded code accessing files, networks, operating system interfaces, storage devices, and many other resources. Like the downloaded code, the code that the browser runs on the client computer deletes the file, unfairly uses system resources, searches the information stored on the computer, finds a less secure computer, and asks the user for confidential information. It is more secure for this code because it can (phishing), plant viruses on the computer, use it to attack other computers, spread the virus on them, and so on. Therefore, web browsers such as Internet Explorer do not allow code from untrusted servers to run unless the user allows it.

Many existing browser-based runtime environments that run downloaded code, such as Java applets, ActiveX ™ controls, and Firefox extensions, ask the user for comprehensive permission to run and access system resources. do. An ActiveX control is a computer program module that can be executed by Internet Explorer when inserted into a web page and accessed, that is, when the web page is downloaded from the web server 100. When code such as an ActiveX control is downloaded as part of a Web page and attempts to run in Internet Explorer, the browser displays a warning message to the user, unless the user explicitly permits or authorizes the execution of the control, or other examples. Prevents the entire control from running unless the user explicitly allows code to run from that server or from that server's network domain. When the user approves the execution of this control, it can access various system resources.

Other existing runtime environments, such as the Microsoft Windows Vista® operating system, provide a level of security granularity that is insignificant for this user, for example by asking the end user for permission to view the file. Programming languages such as Java allow downloaded code scripts to access restricted resources on a computer using secure credential information, such as digitally signed certificates. However, the security credentials of the downloaded code are exposed, and the user is usually responsible for maintaining their credentials, for example, updating the credentials upon expiration of the credentials and keeping them confidential. Furthermore, programs written in the web programming language in use (such as JavaScript or Java) may not be able to use certain system resources, such as special devices, even if allowed, because the language does not have an interface to these resources. Such resources can be accessed through "native" programming languages such as C ++, but not only is the communication between the native language and the web programming language complex, but existing programming schemes also provide features that integrate native programming with browser-based web applications. Can not provide.

Because of these security restrictions, applications developed in traditional web programming schemes are less capable of providing rich user interfaces that match the user interfaces provided by native applications in terms of access to system resources and other features. Existing schemes merely provide rudimentary, complex security features that burden application developers with security. It is therefore necessary to have a programming scheme that allows programmers to quickly and easily develop Web applications that can securely access highly secure system resources.

<Overview>

In general, in a first aspect, the invention is a risk class for a computer program code component that includes at least one component task operative to execute at least one limited system task, the description associated with the component or the component. Generating a risk class based on the signed digital certificate; Generating a description of the component operation; And presenting a prompt to a user for permission to execute the at least one limited system task, wherein the prompt comprises a description of the risk class and the component task.

Embodiments of the invention may include one or more of the following features. The risk class generation step may be responsive to receiving a web page that includes computer program script code to execute the computer program code component. The risk class may be one of at least two risks, including the highest risk and the lowest risk. Prompting the user for a prompt may occur in response to a first reference of the component by the script code executed in response to a web browser receiving a web page associated with computer program script code. The computer program code component may be executed in response to an invocation of a plug-in executed in the web browser by the script code executed in response to a web browser receiving a web page associated with the computer program script code. Prompting the user for a permission may include displaying a predetermined designated permission corresponding to the at least one restricted system job, the designated permission being executed by an end user. Can be given as a precondition for.

In general, in a second aspect, the present invention provides a computer implemented method that enables web browser based code to execute limited system tasks on a client computer. The method includes providing, at a server computer, computer program code to the client computer, the computer program code comprising at least one component having at least one component task that invokes the restricted system task, wherein the computer program code comprises the component. The implementation further comprises prompting the user for permission to perform the restricted system tasks, and further in response to receiving permission from the user. Invoke a limited system task, and the prompt is based on the hazard class associated with the component and the component task. The prompt may include the risk class associated with the ingredient. The program code may be a web browser plug-in. The component may be associated with a risk class selected from among a plurality of risk classes, and the risk class may be a simple phrase based on the risk class. The hazard indicator may include a phrase based on at least one task provided by the component. The component may include an implementation function and an interface definition describing the implementation function. The prompt may display a permission request on the output device of the computer. Receiving an authorization from the user may include receiving an acknowledgment from the user via an input device of the client computer. The method may further comprise receiving a certificate of a signing authority associated with the component, wherein the risk class may be further based on the certificate. The limited system task may include accessing a file, accessing a network, accessing a display device, or a combination thereof.

In general, in a third aspect, the present invention provides a computer implemented method that enables web browser based code to execute limited system tasks on a client computer. The method includes providing, at a server computer, computer program code to the client computer, the computer program code comprising at least one component having at least one component task that invokes the restricted system task, the code being associated with a web document. Executed by the web browser in response to invoking the component by script code, the code operative to invoke the restricted system task in response to receiving input from a user through the web browser, the input Cause an action associated with performing the task, which implicitly grants consent to perform the task. The operation may include at least one step in performing the task.

In general, in a fourth aspect, the invention includes a component task from computer program script code executed in response to receipt of a web page by a web browser, the component comprising at least one task operative to execute a limited system task. Receiving an activation of the box; And in response to receiving input from a user via a web browser, causing the component task to execute the restricted system task, the input causing an action associated with performing the task, wherein the action is Rather than an explicit grant of permission to perform the task, the operation implicitly grants permission to perform the task.

In general, in a fifth aspect, the present invention provides a computer implemented method that enables web browser based code to execute limited system tasks on a client computer. The method includes displaying a prompt requesting permission from a user performing a restricted system task in response to invoking a component task; And invoking the restricted system task in response to receiving an authorization from the user, wherein the prompt refers to the object or service on which the component task operates.

In general, in a sixth aspect, the present invention provides a computer readable medium comprising computer-executable instructions for causing computer program code to be executed in a web browser to perform a security restriction task, the instructions comprising at least one of an interface and the interface. Providing a component comprising a native language implementation that implements a portion to the web browser via a computer network, the implementation responsive to invocation of the interface by a plug-in code in the web browser; Operate to invoke an implementation, the native implementation further operates to present a prompt to the user for permission to perform the task and to invoke the task in response to receiving permission from the user; , From the above Is based on a hazard indicator associated with the component, the prompt is further based on at least one permission requirement associated with the ingredient, the prompt includes a description of the task associated with the permission requirement, the description of the ingredient Refers to at least one application specific feature.

Embodiments of the invention may include one or more of the following features. The computer readable medium may further comprise computer-executable instructions for receiving a certificate of a signing authority associated with the component, wherein the risk indicator is based on the certificate and the task. The security restricted native operating system task may be accessing a file, accessing a network, accessing a display device, or a combination thereof.

In general, in a seventh aspect, the present invention provides a computer readable medium comprising computer executable instructions for enabling browser-based program code associated with a web page to selectively access native operating system resources of a browser host computer. The instructions further comprise an implementation function operable to perform a restricted system task on the browser host computer in response to receiving permission to access the restricted system task from a user of the browser host computer; Receiving a component that includes an interface to enable the to invoke the implementation function; In response to invoking the interface by the browser-based program code, prompting the user for permission to perform the restricted system task; And invoking the implementation function to perform the limited system task in response to receiving an affirmative response from the user.

In general, in an eighth aspect, the present invention provides a computer readable medium comprising computer executable code, the computer executable code prompting for permission to execute a component of the computer executable code, wherein the prompt is associated with the component. Based on an associated risk indicator, the prompt further based on at least one permission requirement associated with the component, the prompt including a description of a task associated with the permission requirement, wherein the description refers to at least one application specific feature. Display-; And in response to receiving an affirmative response to the prompt from the user, providing a computer readable medium for granting the component permission to execute the task defined by the permission requirement.

In general, in a ninth aspect, the present invention provides a processor comprising: a processor; Memory coupled to the processor; And program instructions provided to the memory, the program instructions executable by the processor to provide computer program code to a client computer at a server computer, the computer code having at least one component task to invoke a limited system task. A component, wherein the code is executed by the web browser in response to the activation of the component by script code associated with a web document, the code in response to receiving input from a user through the web browser Operative to invoke the restricted system task, the input causing an action associated with performing the task, the action implicitly granting consent to perform the task.

The present application can be best understood through the following detailed description with reference to the accompanying drawings. In the drawings, like reference numerals denote like elements.
1A-1E illustrate exemplary systems for executing components of a web browser in accordance with an embodiment of the present invention.
2 is an illustration of information on certain components according to an embodiment of the invention.
3 is an illustration of a prompt requesting permission to execute certain components in accordance with an embodiment of the present invention.
4 and 5 illustrate exemplary file upload components in accordance with an embodiment of the present invention.
6 illustrates an exemplary computing system that may be used to implement processing functionality in accordance with an embodiment of the present invention.

The following detailed description is presented to enable any person skilled in the art to make and use the invention, and is provided with regard to a specific application and its requirements. Those skilled in the art will be able to easily modify various embodiments, and the general principles described herein may be applied to other embodiments and applications without departing from the spirit and scope of the invention. Moreover, in the following detailed description, numerous details are set forth for purposes of explanation. However, it will be apparent to one skilled in the art that the present invention may be practiced without these specific details. In many instances, well-known structures and devices are shown in block diagram form in order not to unnecessarily obscure the description of the present invention. Therefore, the present invention should not be limited to the embodiments shown, but should be in accordance with the widest scope in accordance with the principles and characteristics of the present invention.

Although the present invention is described in terms of specific embodiments and exemplary drawings, those skilled in the art will recognize that the invention is not limited to such embodiments or drawings. Those skilled in the art will appreciate that the operations of the various embodiments may be implemented using hardware, software, firmware or a combination thereof as appropriate. For example, some processes may be performed using a processor or other digital circuitry under the control of software, firmware or hard-wired logic. (The term "logic" herein refers to fixed hardware, programmable logic, and / or suitable combinations thereof, as will be appreciated by those skilled in the art of carrying out the described functions.) Software and firmware may be stored in a computer readable medium. Any other process can be implemented using analog circuitry well known to those skilled in the art. In addition, in the embodiments of the present invention, a communication component may be used as well as a memory or other storage device.

1A-1E are diagrams of platforms for executing components 148 of web browser 104 in accordance with embodiments of the present invention. 1A shows the entire functional unit of the platform, and FIGS. 1B-1E show the details of a specific functional unit. Component 148 may be, for example, a computer program code module that provides services that are not typically used for web-based code such as JavaScript ™ in web browser 104. These services include, for example, drag-and-drop operations, text-to-speech operations, and other limited or native system tasks and resources 130. The software developer may add an additional component 148 by defining an interface 162 that specifies one or more operations the component provides and an implementation 164 of tasks. An example of a component is a drag-and-drop user to upload an image to the Flickr® online photo-sharing service by dragging and dropping a file from the user's computer into the user interface area provided to the web browser 104 by the FlickrUploader component. Contains the FlickrUploader component that provides the interface. Other exemplary components include text-to-speech components and image processing components (called ImageAlter). Component 148 may be used in user provided browser based program code 107, such as JavaScript code downloaded as part of a web page from a web server. According to the example platform of FIG. 1A, which includes a plug-in interface 108 and a daemon 140, such browser-based program code may make use of component 148. Because component 148 provides features that are not present in web browser 104, component 148 expands the feature set of end user machine 102 that may be used for web page 106. Features provided by the component usually make use of limited system tasks and resources that can be exploited, so effective security measures can be used to ensure that the component can use the restricted tasks and resources in an explicit or implicit manner by end users. This is necessary.

System 102 includes component execution logic 140 that provides core service 142 and component provider interface 146, such as a C provider interface and a Ruby ™ interpreted programming language provider interface. do. Although C and Ruby are illustrated here, this component provider interface 146 can also support other languages such as C ++, Java, and the like. Component execution logic 140 includes a component set 148 that includes at least one component 160. Each component includes an implementation function (s) 164 and an interface definition (s) 162 describing the implementation function (s) 164. The interface definition may be, for example, a JSON manifest file describing the name and parameters of the job (s) provided by component 160 and implemented by implementation 164. As an example, the implementation function (s) 164 executes the task (s) on the browser host computer 102 if it receives permission from the browser host computer user for limited system task (s). That is, the implementation function may be a specific limited or confidential task (eg, accessing a file or network connection, communicating over a network connection, or printer, voice synthesizer) to perform if the function is executed by the user. Or accessing a system resource such as a storage device). Each implementation can choose the appropriate precision for this security prompt. For example, the implementation function may prompt the user for each file access, all file accesses, file access for the duration of the web browser session, and the like. At least some of the implementation function (s) may be implemented using native code as is well known to those skilled in the art.

Restricted system tasks can be called, for example, because native features (ie, callable from languages such as C or C ++), but typically because component 148 can be written in a language that does not directly access native features such as Ruby. A function that may not be directly available to component 148). This native function accesses system resources by providing a login credential or digital certificate of a user associated with the user or end user machine 102 to establish the identity and access permissions of the user. Native functions may, for example, display information on an output device and / or perform operating system specific functions such as receiving information from an input device, dragging and dropping, text-to-speech conversion, file browsing, and the like. Native functions can access data stored on magnetic disks, optical disks, semiconductor-based memories, and the like.

Such limited system tasks can only be accessed by native code, such as code written in a language such as C or C ++ that is compiled into machine-level instructions. Programming languages commonly supported in web browsers, such as Java, JavaScript, and Ruby, do not have features or hardware features that access a particular native operating system, or even if the language does not have such features, these features are usually these It is disabled by web browser 104 because of security risks posed by unlimited access to features. The plug-in interface 108 allows the browser-based code 107 (eg, user-supplied JavaScript code downloaded from the web server 100) to be native to the component implementation 164 that the developer provides for a particular public feature. Such restricted features can be accessed by providing component execution logic 140 that allows implementation of component 148 to access such features through code portions or through built-in native code. To make it work. As an example the plug-in interface 108 is a browser plug-in that interacts with the web browser 104 via a browser plug-in application programming interface (API) such as ActiveX or NPAPI. The component 148 (including both the native and non-native code portions), as well as the browser-based program code 107 may be secured, such as security user prompting, to confirm that the end user approves the invocation of restricted tasks. By including a check in the component implementation 164 or in which the component implementation 164 and / or the plug-in common library 117 are restricted to certain types of permissions (eg IRC connection permission). By requiring the end user to be available before invoking the feature, it prevents unauthorized use of limited system work.

Core interface 144 includes native implementations that access operating system or hardware features, such as user interface drag and drop, file access, secure user prompting, text-to-speech conversion, and GPS interface. There are built-in components, or predefined components, that access these predefined native implementations from common languages such as JavaScript and Ruby. Component 148 includes predetermined components such as components for drag and drop, file access, secure user prompting, text-to-speech GPS, and the like.

As an example, a system module comprising a plug-in interface 108, core services 142, and component 148 is provided by an installation daemon 170 that receives modules from a distribution server 150 via a computer network, such as the Internet. Installed on the end user machine 102 (ie, used for execution). The installation daemon 170 is installed by the user and inherits the user's access credentials that the daemon 170 uses to install the system module on the user machine 102. The system module inherits this user access credential and uses this credential to execute native code to access restricted system tasks.

The web browser 104 includes a web page 106 received from a web server 100. The web page may include or reference user provided JavaScript code 107. This JavaScript code 107 is an example of browser-based code that may be computer program code that may be invoked, ie invoked, by the web browser 104. The web browser 104 also includes a plug-in interface 108 that interacts with the browser-specific plug-in API 116 using the generic browser plug-in API 114, which in turn is the browser core. Interact with 118 to interface universal browser plug-in API 114 with browser 104. The plug-in adapter layer 112 provides user-provided script code 107 (such as JavaScript) and limited system tasks that are not typically available in the scripting language code execution environment that the web browser 104 provides to the web page 106. It provides an interface between a native code plug-in common library 117 (such as C or C ++) that can be invoked and a general purpose browser plug-in API (such as JavaScript) to interact with. Plug-in adapter 112 is invoked in response to a component launch command, for example, from browser-based program code 107. In contrast, the plug-in adapter 112 may be invoked by the general-purpose browser plug-in API 114, for example, in the form of callbacks that provide results and notifications to the user JavaScrip 107.

Core logic 140 includes one or more language specific component provider interfaces 146 as described above. Component execution logic 140 may be implemented as a daemon, i.e., a process that runs in the background and / or independent of a particular user, and communicates with one or more plug-in interfaces 108. The core logic daemon 140 loads the interface and implementation for each of the components 148, for example, when this daemon is initialized or when some request is received from the component 160. This component implementation is the behavioral loading or linking process that component 164 deems appropriate for that language (e.g., dynamic library open call for C-language components or Ruby appropriate for Ruby components). Load operation). Each component provider interface 146 receives a component activation request from the plug-in adapter 112. This component invocation request is, for example, a component suitable for transmitting via interprocess communication from the plug-in adapter 112 that is part of the browser process to the core interface 144 of the core service 142 that is part of the core logic daemon process 140. Serialized version of the invocation command. The core interface 144 sends this sequence of activation commands to the component provider interface 146 which invokes the appropriate implementation of the corresponding component 160, in which case this function and this corresponding component are required to invoke the component. It is stated in As an example, provider interface logic 146 may revoke permission from the user of the browser host computer in response to job completion. As another example, the provider interface logic may revoke authorization from the user of the browser host computer in response to the end of the network session associated with the browser based program code.

The provider interface 146 may pass the interface definition to the plug-in adapter logic. In languages such as Ruby that provide an introspection of types, this interface definition can be derived automatically from user-provided component implementations. Plug-in adapter 112 may receive an interface definition from its components.

Provider interface 146 may load component (s) 148 from distribution server 150, storage device or other data source. Component (s) 148 may be, for example, a shared library, and may be a package that includes an interface definition, an implementation of this interface, and a documentation of this interaction. Component (s) 148 may be provided by any trusted entity. The operation of each component 148 is substantially secure provided that this implementation is received after user permission is required before performing any operation on any system resource (ie, a security breach may occur). No access to system resources). User-supplied JavaScript will not be able to perform malicious behavior on the computer 102, as long as the user is prompted, typically this user-supplied JavaScript cannot send any response to this prompt.

The implementation function can provide some output, in which case the provider interface logic and plug-in adapter logic delivers that output to browser-based program code. That is, a predetermined response can be returned from component (s) 148 to user-provided JavaScript.

Depending on the certificate that signed a particular ingredient and all relevant information about that ingredient, the end-user can better understand the risks of the license. If the web page requires a component, the system gets the component description. This description may or may not be signed. Unsigned components are "anonymous" and are implemented as "sand-boxed" components. The risk of a signed component is determined dynamically and securely based on the certificate the component is signed with. This hierarchical approach enables distributed development of security components. The user is prompted for permission to perform the work provided by the component. The type and nature of this prompt presented to the user is based on the risk of working with the ingredient and the specific ingredient.

As noted above, a "risk rating" can be created for a component that allows the user to determine whether the component can be run on the user's computer. This risk class is based on the certificate that signed the component and other information about the component. The certificate that signed this component is either an authoritative entity that trusts the provider of this component (in this case it is considered an official component), or a third party component (in this case a trusted authority) Ensuring that the identity of this component provider (such as the issuer) is correct, or an independent component (in which case this component provider is known to the certification body), or an anonymous component (in this case, the certification body Warning about execution). This risk level is communicated to the user when the user is asked to execute the ingredient. As an example, if one or more tasks provided by the component are invoked, the user is presented with a risk rating when there is a request for permission to execute certain limited system tasks to be performed by the component. As an example, this permission request may be displayed in response to the initialization of this component, in which case the initialization may occur in response to a browser receiving a web page containing script code, which script code may operate on the component (e.g., method). , Statements of invocation, procedures or functions). As another example, this permission request is displayed in response to the invocation of a particular task by this script code before executing this component.

As an example, the risk classes correspond to the layers in the multiple risk classes ranging from high risk to low risk. Hierarchical risk rating schemes indicate the level of attention a user should use when using a particular ingredient. As an example, each of the plurality of layers corresponds to the aforementioned risk class. In other words, the risk is based on the certificate that signed the component. Components that require access to specific resources prompt the user to perform limited tasks, such as viewing a file. This prompt changes with the risk of the ingredient. This risk may refer users to simple phrases based on this risk (such as "very low risk") or more specific phrases based on this risk and the actions that the component is expected to trigger (such as "deleting or overwriting pictures stored on a computer". Very low ").

Four risk classes are provided as an example, and a component may be associated with any of these risk classes. Risk ratings can be associated with each of these risk classes.

hierarchy Risk Formula ingredients Reliable and trusted entities guarantee the integrity of this ingredient.
Very low risk Third Party Ingredients Trusted and authoritative entities ensure that the identity of the issuer is correct.
Low risk Independent components Known to an authoritative entity that the publisher of the ingredient can trust.
Medium risk Anonymous ingredients Trusted and authoritative entities warn against the installation of this component.
High risk

This scheme provides safe external authoring of the components. The certification authority acts as a "gate-keeper" and issues signing certificates to these various entities. Depending on the certificate signing the specific ingredient and the relevant information describing the ingredient, a meaningful description of the risk of this ingredient may be generated and presented to the user. In other words, the risk is based on the credibility of this certificate. The higher the credibility, the lowest the risk.

As an example, a component description is obtained when using a component, for example, when a script code on a web page invokes the component. This statement may or may not be signed. Unsigned components are "anonymous" and run in a protected "sandbox" environment. The risk of a signed component is determined dynamically and securely based on the certificate the component is signed with. This hierarchical approach enables distributed component development. Moreover, the execution of components belonging to the high-risk class can be prohibited by default, which allows component developers to use most system resource types with minimal risk for average users.

As an example, a permission object represents a specific task execution permission associated with this permission object. Ingredient licenses include names and descriptions. For example, a permission ConnectToChatServer that represents a permission to connect to a chat server may have an associated description "Connect with an IRC (chat) host". These component permissions represent tasks that are important to the user, such as application specific tasks such as connecting to a chat server. Similarly, the description of an ingredient permit describes this permission in terms that are important to the user. For example, "connect with an IRC (chat) host" is more important than "publish a network connection" or "publish a network connection on a port in the range 6667-7002." “IRC (chat) host” as part of this description refers to application specific features such as IRC or chat host. Descriptors listing ports 6667-7002 without specifying an application do not refer to a specific application, and therefore not to an application specific feature.

As an example a requirement for a grant object may be associated with a component operation that requires security confidentiality, which may require obtaining a corresponding grant object, such as the ConnectToChatServer permission described above, during initialization or initial processing of this component. If a component needs to be executed, it is asking for permission to trigger a task. The authorization object required for some operation can be obtained by prompting the user using secure user prompting described elsewhere herein. If the user responds with affirmative "Yes" to the prompt describing the action to occur, then the user is granted permission to invoke the task. As another example, a user may have an associated digital certificate that may replace secure user prompting, thereby providing the user with permission to invoke the task. This task can be associated with the maximum required risk, so that a user with a certificate that is at or below the required maximum risk for this task can run it.

For example, the chat component may include a task named "connection" to open a network connection to the chat server. This chat component can be written in part in one language, for example Ruby, and in other native languages, for example C. This native language implementation may include a direct invocation of the operating system network connectivity, in which case the native language implementation checks for the existence of a permission associated with the user, in which case the permission is performed. Corresponds to a network connection function such as a task to be performed, for example, ConnectToChatServer permission. If this permission is present (eg associated with a user), this native implementation invokes the operating system network connectivity. Without this permission, the user invokes a secure user prompting user interface that presents some prompt, such as, "Would you give permission to communicate with the chat server over this network? The risk of this action is low." This prompt includes a phrase that describes the action to be performed, which action is described as a component action, which in this example is a "connect" action to establish a network connection to the chat server. This prompt describes the required permission in component work, such as communication with a chat server. This prompt also describes the risk, for example low. This prompt describes this operation in a semantic meaning that differs from the meaning of the underlying operating system functions, such as access to port 7000 of the server "a.b.com", which is of little importance to the user of that component.

2 is an exemplary diagram of metadata information for a component according to an embodiment of the present invention. 2 shows component name 202 (ImageAlter), type 204 (standalone), version 206 (1.0.1), corelet (ie component) API versions 208 and 93, description (210) (“Corelets based on ImageMagick, which changes the image locally and provides it via HTTP”), and an interface specification 212 including a job specification 214 and a documentation 216. Shows the properties of the component 200. Component execution logic 140 of FIG. 1A registers interface and implementation (as defined by interface specification 212) as component 148 using interface specification 212. Component execution logic 140 may determine the interface of this component by extracting the name and parameter type of each task from interface specification 212 as an example. An implementation may contain program code in the form of source, object or byte code written in a language such as Ruby, including native implementation (written in a language such as C ++), for example, for accessing native operating system functionality. It may include. Once registered, the browser based code 107 can use the tasks provided by the component's interface. In this example, interface 212 is defined in text form and contains a single task named Alter. This exemplary interface specification is Alter (<path> file, <integer> maxwidth, <integer> maxheight, <integer> rotation, <string> quality, <list> effects, <string> format.

Additional work may be included in the interface by adding additional entries to the metadata in the form of interface specification 212. Documentation 214 provides a description of an exemplary Alter task, "Return to a localhost URL where you can change the image and access the results." This documentation 214 can be automatically converted for use in a development tool such as an integrated development environment.

3 is an illustration of a prompt displayed in a web browser for requesting permission to execute certain components in accordance with an embodiment of the present invention. 3 shows a prompt dialog 300 displaying a prompt indicating that the host computer is requesting permission to use and operate a new service (such as a component) on the user's computer. This prompt asks the user to carefully review the required authorization list 302 prior to approval. Required permissions 302 include display desktop notification permissions 304 and download and operation service permissions 306. Display desktop notification permission has already been granted by the user, as indicated by the check mark next to the description of permission 304. Download and activation service permission 306 further includes details about the service to be downloaded and operated, including notification service description 308 indicating that the notification service is a service for delivering desktop notifications. The user may deny the download and operation permission by selecting the Deny button 310. The allow button 312 can be selected to allow the download and run services to run. For custom components, a similar prompt may be displayed when this component is invoked by browser-based code.

4 and 5 are exemplary diagrams of a file upload component according to an embodiment of the present invention. The file upload component 400 allows the picture file to be dragged into a predetermined area 410. This file is then uploaded to Flickr® by this component. 5 shows a picture 510 uploaded from the picture directory. This interface also includes transform application component 520 and picture scaling component 530. These components invoke local operations on the user's computer (such as the ImageMagick library) to process the picture from within the web browser.

As an example, if a component is missing, component execution logic 140 queries any number of distribution servers to find and retrieve that component, including resolving the dependency. Component 148 is versioned, i.e., associated with a version number, and other components may be required by the plug-in interface 108 at the level of the end user machine 102. As an example, component 148 is associated with a version including a major version number, a minor version number, and a micro version number that make up a version, such as 2.0.1. The component has a unique name defined, for example, by the Internet domain name of the component provider in combination with the name describing the component itself. Thus an exemplary component name is "com.vendor.ImageAlter". Version specifiers may include major and minor numbers, or major, minor and micro numbers. The component version matches the version qualifier if all numbers present in the version qualifier are the same as the corresponding number of the component version. As an example, when deciding how to satisfy a requirement for a component, what updates are available for the three lists, the end user machine 102 (priority 1), the component to be installed (priority 2), and the network, For example, consider a component (priority 3) obtainable from the distribution server 150.

According to embodiments of the present invention, a security mechanism is provided. Security mechanisms include secure user prompting, implicit consent, and secure resource representation. Secure user prompting, in one aspect, includes displaying a dialog with a prompt describing a particular task to be performed. This prompt describes an operation using at least one component specific term that refers to the type of object or service on which the component operates. For example, the prompt "Allow access to photo" refers to the term "photo", which is the type of object on which the component that allows access to the photo operates. As another example, the prompt "Allow access via instant messaging" refers to the term "instant messaging", which is the type of service on which the component that allows access to instant messaging operates. Component specific terms are, for example, more specific than the description of the underlying operating system function (s) on which the component is invoked. For example, an operating system level task that grants a view permission will have a general description of the view permission, regardless of the particular application or component object or service.

In accordance with embodiments of the present invention, the implicit consent security feature implies an affirmative consent of a user performing a task in response to a user action rather than in response to an explicit request for permission to perform a task. As an example of an implicit consent, a user communicates with a computer to specify which file is the starting point for a potentially dangerous task. A component may interpret this conversation as consent by the user performing some task on the file, such as limited system tasks. Similarly, for other resource types, a component that restricts access to a resource type can allow that user to perform certain tasks on that resource type in response to the user interacting with the component's user interface in a particular way. . For example, user interaction with a user interface component implies that this user implicitly grants permission to perform a task. For example, the user action of dragging a file to a browser application displaying a web page is to give an implicit consent that the code associated with that web page can work (eg, read or write) on the specified file.

As another example, the system may, for example, present an in-context dialog that provides a user name and login credentials required by some component. This input will be presented by the plug-in common library 117, which is outside the control of the untrusted web page 106, in which case the user is not prompted to perform a task, such as "Log in to Flickr". The credential acquisition can be integrated into the flow. In this case, the user can refuse to give Flickr credentials while using a particular website, and the end user spends less intellectual expenditure. However, even if the ultimate result is the same, the user directly asked to approve some action outside the control of the web page.

Implicit consent enables the integration of multiple user conversation steps into a single step. With implicit consent, the user is not explicitly asked for permission to perform the work. Instead, the user's permission to perform work is inferred from the user's actions. Implicit consent improves the security and ease of using Web conversations. In the Flickr upload example, the flow is, for example: Without implicit consent, (1) the user visits a page uploaded to Flickr but not the output of Flickr; (2) the user is sent back to the Flickr pate which gives Flickr permission; (3) the user completes authorization to Flickr; (4) The user closes the Flickr page window, returns to the original page, and presses a button to complete the authentication.

With the provisional consent, the same authentication flow is performed in fewer steps as follows. (1) The user visits a page that is uploaded to Flickr but not the output of Flickr; (2) a "security dialog" is placed on the page; This security dialog handles authorization to Flickr outside of the control of the original page; (3) The user enters credentials and clicks ok; And (4) the original page is automatically notified. Clicking on the button on the original page to indicate that authentication is complete at the end of the first flow is not necessary for implicit consent. Furthermore, the next access of the Flickr service can automatically provide the user credentials to Flickr so that the user does not have to provide the credentials again even if the login expires. This credential is kept safe and confidential by the Flickr ingredients.

Some components in the Flickr login example require permission to execute a task that requires login credentials, such as logging in to Flickr. The web page invokes the ability to authorize Flickr. The core service 142 performs prompting for credentials and transmission of authentication requests in the direction of Flicker access components (eg, FlickerUploadr shown in component 148) outside the control of the web page. When the authentication request is completed, the web page receives a return value that may be "authorized", "user refuses authorization" or "authentication failed (bad credentials)". Web pages are more secure because they do not have access to user credentials (such as login names and passwords) for sites where authentication is performed.

As another example, to communicate with a web-accessible camera (webcam), using explicit consent, (1) the user visits a web page that provides a webcam feature; (2) The user clicks the "select picture from webcam" button; (3) the user is urged to allow taking pictures outside the control of the web page; And (4) the user clicks the "Capture" button to take a picture. With implicit consent, the same webcam conversation is performed in fewer steps as follows. (1) the user visits the webcam page; (2) the user is presented with a dialog displaying the current webcam picture, which is outside the control of the web page; (3) The user clicks the "Capture" button to give the website an implicit consent to use the webcam. According to embodiments of the present invention, a secure resource indication is generated by the user conversation, which can be accessed in JavaScript code as a secure resource identifier. This identifier is associated with a particular resource, such as a file, and is not changed by browser based (eg JavaScript) code. In one aspect this identifier is any unique number that can be referenced but is not changed to refer to another file or resource. The file selection validity period depends on the page duration, so this identifier becomes valid after the browser closes this page.

Component implementation prompts end users regardless of browser-based code (such as JavaScript) on a web page. The component code is therefore bound to a response provided by the user, such as granting (positive) or denying (denying). In one aspect, an operation that may be security sensitive, such as accessing or deleting stored information, or using a network connection, is a potential security risk and identifying a certificate corresponding to that operation by security user prompting, or as an example. It must be protected by a permission object.

As an example, a white-list feature may be provided that enables or disables the execution of a particular component or a particular version thereof on a particular web site. White list entries allow certain sites to use certain components. Distribution server 150 distributes a signed distribution file that includes a white list of domains allowed to use the component, a blacklist of components to be removed (eg, deleted), and a blacklist of platform versions to be removed. For example, if a version 1.0.1 of a component is known to have a bug, you can use the blacklist feature to prevent future execution of version 1.0.1. The white list feature may be controlled by the user. For example, a music site can use any component to load a song into the user's Apple iTunes® music player directory. This component may ask the user to allow the import once or each time, or may never allow it.

As an example, a client using the plug-in interface platform 108 of FIG. 1A includes a blacklist feature and / or a specific version thereof for removing components. The client downloads a digital signature bundle that includes a permission bundle. This download may occur at specific times or periodically or at any other times in response to a message received from the server. The license bundle contains a revocation list that lists one or more components to be removed and corresponding versions. Installed components on the revocation list are removed and subsequent attempts to reinstall the removed components will not succeed. The plug-in interface platform 108 itself may be remotely disabled by a designated entry in the revocation list.

New versions of components can also be used from time to time. Since there are many components that can be installed on the end user machine 102, maintaining all of the installed components can negatively affect performance and / or consume excessive resources. When a user visits a site that uses an ingredient, the site expresses the ingredient requirement in a requirement statement, such as an ingredient name, version, and minor version triplet. The entire requirement is stored with the last name required. The update check periodically removes outdated requirement statements and checks the distribution server for components that meet the remaining current requirements and are newer versions of the components currently installed on the machine 102. This newer version is downloaded as a background and stored in the update cache, for example, without stopping the running component. Then, when a web browser 104 visits a site that expresses a requirement to better serve available cached updates, the user is prompted to authorize the installation of the downloaded update. Older components can be identified and deleted, for example, by finding components that are not used to meet current requirements and have not been used for a long time. These components can be removed from the machine 102 with little negative impact.

6 illustrates an exemplary computing system 600 that may be used to implement processing functionality in accordance with an embodiment of the present invention. This type of computing system can be used, for example, in clients and servers. Those skilled in the art will appreciate how to implement the invention using other computing systems or architectures. Computing system 600 may be, for example, a desktop, laptop or notebook computer, handheld computing device (PDA, cell phone, palmtop, etc.), mainframe, server, client, or any other type that may be desirable or suitable for a particular application or environment. It may be a dedicated or general purpose computing device. Computing system 600 may include one or more processors, such as processor 604. Processor 604 may be implemented using a general purpose or dedicated processing engine such as, for example, a microprocessor, microcontroller or other control logic. In this example, the processor 604 is connected to the bus 602 or other communication medium.

Computing system 600 may also include main memory 608 such as random access memory (RAM) or other dynamic memory that stores information and instructions to be executed by processor 604. Main memory 608 may also be used to store temporary variables or other intermediate information during execution of instructions to be executed by processor 604. Computing system 600 may likewise include a read only memory (ROM) or other static storage device coupled to bus 602 for storing static information and instructions for processor 604.

Computing system 600 may also include an information storage system 610, which may include, for example, a media drive 612 and a removable storage interface 620. Media drive 612 supports fixed or removable storage media, such as hard disk drives, floppy disk drives, magnetic tape drives, optical disk drives, CD or DVD drives (R or RW), or other removable or fixed media drives. Drive or other mechanism. Storage medium 618 may include, for example, a hard disk, floppy disk, magnetic tape, optical disk, CD or DVD, or any other fixed or removable medium read or written by media drive 612. As these examples describe, storage medium 618 may include a computer readable storage medium having stored therein specific computer software or data.

In other embodiments, information storage system 610 may include other similar components capable of loading computer programs or other instructions or data into computing system 600. Such components may include, for example, a removable storage unit 622, an interface 620 such as a program cartridge and a cartridge interface, a removable memory (e.g., flash memory or other removable memory module), a memory slot, and a software and data removable storage unit. Other removable storage units 622 and interfaces 620 may be transferred to the computing system 600 at 618.

Computing system 600 may also include a communication interface 624. The communication interface 624 can be used to transfer software and data between the computing system 600 and an external device. Examples of communication interfaces 624 include modems, network interfaces (such as Ethernet or other NIC cards), communication ports (such as USB ports), PCMCIA slots and cards, and the like. The software and data transmitted over communication interface 624 are in the form of signals that may be electronic, electromagnetic, or optical, or in the form of other signals that communication interface 624 may receive. These signals are provided to communication interface 624 via channel 628. This channel 628 may carry signals and may be implemented using wireless media, wired or cable, fiber optics, or other communications media. Some examples of channels are telephone lines, cellular phone lines, RF lines, network interfaces, local area networks (LANs) or wide area networks (WANs), and other communication channels.

The terms “computer program product”, “computer readable medium” and the like herein may generally refer to the memory 608, the storage device 618 or the storage unit 622, for example. These and other forms of computer readable media may store one or more instructions for use by a processor that may cause the processor 604 to perform certain tasks. Such instructions are commonly referred to as "computer program code," and when executed, computing system 600 may perform the features or functions of embodiments of the present invention. This code may allow a processor to perform a particular task immediately, and may be compiled to do so and / or combined with other software, hardware, and / or firmware components (such as libraries that perform standard functions) to do so. Note that there is.

In embodiments in which the components are implemented using software, the software is stored on a computer readable medium and loaded into computing system 600 using, for example, removable storage drive 614, drive 612, or communication interface 624. Can be. Control logic (in this example, software instructions or computer program code) causes the processor 604 to perform the functions of the invention described above when executed by the processor 604.

It will be appreciated that for the sake of clarity the foregoing detailed description has described embodiments of the invention in connection with various functional units and processors. However, it will be appreciated that appropriate functional distribution among other various functional units, processors or domains may also be used without departing from the invention. For example, functionality described as being performed by separate processors or controllers may be performed by the same single processor or controller. The description of a particular functional unit is therefore not to be considered a strict logical or physical structure or configuration, but only as a description of suitable means for providing the described functionality.

Although the present invention has been described in connection with some embodiments, it is not intended to be limited to the specific form set forth herein. It is intended that the scope of the invention only be limited by the claims. In addition, although specific features may appear to be described in connection with specific embodiments, those skilled in the art will recognize that various features of the described embodiments may be combined in accordance with the present invention.

Furthermore, although individually listed and described, a plurality of means, components or method steps may be implemented by eg one unit or processor. Moreover, although individual features may be included in different claims, these features may preferably be combined with each other, and inclusion of them in different claims does not mean that feature combinations are impractical and / or poor. Also, the inclusion of a feature in one category of claims does not imply that it is limited to this category, and the feature may be equally applicable to other claim categories as well.

Moreover, those skilled in the art will appreciate that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention. The invention is not limited by the above description, but rather by the claims.

Although only specific embodiments have been described so far, those skilled in the art will recognize that various modifications may be made in the exemplary embodiments without substantially departing from the new teachings and advantages of the present invention. Therefore, all such modifications will be within the scope of the present invention.

Claims (27)

As a computer implemented method,
Generating a hazard class for a computer program code component, the component comprising at least one component task operative to execute at least one limited system task, the hazard class being described in conjunction with the component or the component Based on this signed digital certificate;
Generating a description of the component operation; And
Presenting a prompt to a user for permission to execute the at least one limited system task, the prompt including a description of the hazard class and the component task;
Computer implemented method comprising a. The method of claim 1,
Generating the risk rating is responsive to receiving a web page that includes computer program script code to execute the computer program code component. The method of claim 1,
And wherein said risk rating comprises at least two risks, including a highest risk and a lowest risk. The method of claim 1,
Prompting the user for a prompt may occur in response to a first reference of the component by the script code executed in response to the web browser receiving a web page associated with the computer program script code. . The method of claim 1,
And wherein the computer program code component is executed in response to an activation of a plug-in executed in the web browser by the script code executed in response to the web browser receiving a web page associated with the computer program script code. The method of claim 1,
Prompting the user for a permission includes displaying a named permission, wherein the named permission corresponds to the at least one restricted system operation, and the named permission. Is a computer-implemented method that is given by the end user as a prerequisite for the execution of said limited system tasks. A computer-implemented method that enables web browser-based code to execute limited system tasks on client computers.
At a server computer, providing computer program code to the client computer including at least one component having at least one component task that invokes the restricted system task
Including,
The computer program code further includes an implementation of the component, the implementation operative to display a prompt from the user requesting permission to perform the restricted system tasks and to grant permission from the user. Further actuate the limited system task in response to receiving,
And the prompt is based on a risk class associated with the component and the component operation. The method of claim 7, wherein
And the prompt includes the risk class associated with the component. The method of claim 7, wherein
And the program code comprises a web browser plug-in. The method of claim 7, wherein
Wherein said component is associated with a risk class selected from a plurality of risk classes, and said risk level comprises a simple phrase based on said risk class. The method of claim 7, wherein
And the risk indicator comprises a phrase based on at least one task provided by the component. The method of claim 7, wherein
And wherein said component comprises an implementation function and an interface definition describing said implementation function. The method of claim 7, wherein
And the prompt displays an authorization request on an output device of the computer. The method of claim 7, wherein
Receiving an authorization from the user includes receiving an acknowledgment from the user via an input device of the computer. The method of claim 7, wherein
Receiving a certificate of a signing authority associated with the component;
And the risk level is further based on the certificate. The method of claim 7, wherein
The limited system task includes accessing a file, accessing a network, accessing a display device, or a combination thereof. A computer-implemented method that enables web browser-based code to execute limited system tasks on client computers.
At a server computer, providing computer program code to the client computer including at least one component having at least one component task that invokes the restricted system task
Including,
The code is executed by the web browser in response to the invocation of the component by script code associated with the web document,
The code is operative to invoke the restricted system task in response to receiving input from a user via the web browser, the input causing an action associated with performing the task, the action to perform the task. A computer-implemented method of implicitly giving consent. The method of claim 17,
And said operation comprises at least one step in performing said task. As a computer implemented method,
Receiving an invocation of a component task from computer program script code executed in response to receiving a web page by a web browser, the component comprising at least one task operative to execute a limited system task; And
Causing the component task to execute the restricted system task in response to receiving input from a user via a web browser.
Including,
The input results in an action associated with performing the task, wherein the operation is not an explicit grant of permission to perform the task, and the operation implicitly grants permission to perform the task. A computer-implemented method that enables web browser-based code to execute limited system tasks on client computers.
Displaying a prompt requesting permission from a user to perform limited system tasks in response to invoking a component task; And
Invoking the restricted system task in response to receiving an authorization from the user.
Including,
And the prompt refers to an object or service on which the component operation operates. A computer readable medium containing computer executable instructions that cause computer program code to execute in a web browser to perform a security restriction task.
The instructions include instructions to provide, via a computer network, the web browser with a component comprising an interface and a native language implementation that implements at least a portion of the interface;
The implementation is operative to invoke the native language implementation in response to the invocation of the interface by a plug-in code in the web browser,
The native implementation is further operative to present a prompt to the user for permission to perform the job and to invoke the job in response to receiving permission from the user,
The prompt is based on a risk indicator associated with the ingredient, the prompt is also based on at least one permission requirement associated with the ingredient, the prompt includes a description of an operation associated with the permission requirement, the description A computer readable medium referencing at least one application specific feature of a component. The method of claim 21,
The instructions further comprise instructions for receiving a certificate of a signing authority associated with the component,
And the risk indicator is based on the certificate and the task. The method of claim 21,
The secure restricted native operating system operation includes accessing a file, accessing a network, accessing a display device, or a combination thereof. A computer-readable medium containing computer executable instructions that enable browser-based program code associated with a web page to selectively access native operating system resources of the browser host computer.
The command is
An implementation function operable to perform restricted system tasks on the browser host computer in response to receiving permission to access the restricted system tasks from a user of the browser host computer; Instructions for receiving a component that includes an interface to invoke a mention function;
Instructions for prompting the user for permission to perform the restricted system task in response to invoking the interface by the browser based program code; And
Invoking the implementation function to perform the restricted system task in response to receiving an affirmative response from the user.
Computer-readable medium comprising a. A computer readable medium containing computer executable code,
The computer executable code is
Display a prompt for permission to execute a component of the computer executable code, the prompt based on a risk indicator associated with the component, the prompt also based on at least one permission requirement associated with the component, The prompt includes a description of the task associated with the permission requirement, wherein the description refers to at least one application specific feature; And
In response to receiving an acknowledgment to the prompt from the user, granting the component permission to perform the task defined by the permission requirement. A processor;
Memory coupled to the processor; And
Program instructions provided to the memory and executable by the processor to provide computer program code to a client computer at a server computer
Including,
The computer code includes at least one component having at least one component task for invoking limited system tasks,
The code is executed by the web browser in response to the invocation of the component by script code associated with the web document,
The code is operative to invoke the restricted system task in response to receiving input from a user via the web browser, the input causing an action associated with performing the task, the action to perform the task. A system that implicitly grants consent. The method of claim 26,
The operation comprises at least one step in performing the task.

Images